NIST AI RMF, MeasureMEASURE 2.11

Apply data governance and management practices appropriate to the system's intended purpose, covering your design choices; how you collected the data and, for personal data, why you originally collected it; your data-preparation operations, such as annotation, labelling, cleaning, updating, enrichment and aggregation; the assumptions you made about what the data measures and represents; an assessment of whether the data sets you need are available, sufficient in quantity, and suitable; examination of the data for biases likely to affect health and safety, harm fundamental rights, or lead to discrimination prohibited under Union law, especially where one operation's data outputs become a later operation's inputs; and measures to detect, prevent and mitigate any bias you find.

If your high-risk AI system continues to learn after it is placed on the market or put into service, develop it to eliminate or reduce as far as possible the risk of biased outputs feeding back into future operations, and put mitigation measures in place for any feedback loop that remains.

Ensure the tool is fairly and equitably applied and does not result in unfair discrimination or directly or indirectly cause harm to an enrollee.

If you provide or deploy an automated employment decision tool for use on New Jersey applicants or employees, including a tool that scores, ranks, or classifies candidates or that assesses schedule availability, adequately test it before use to confirm it does not adversely affect a protected class.

Conduct regular impact assessments of the high-risk AI system for algorithmic discrimination.

Before screening a candidate or employee in New York City with an automated employment decision tool, a product must be the subject of a bias audit performed within the prior year, publish a summary of that audit, and notify each affected candidate or employee at least ten business days beforehand of the tool's use and the job qualifications and characteristics it assesses.

Certify annually to the Alabama Department of Insurance that the artificial intelligence does not rely on a group dataset, is applied fairly and equitably consistent with applicable federal guidance, and does not discriminate against any subscriber group or enrollee.

Establish a documented, risk-based governance and risk management framework, including a cross-functional governance group drawing on legal, compliance, risk management, product development, underwriting, actuarial, data science, marketing, and customer service, designed to determine through quantitative testing whether your use of an external consumer data and information source, or an algorithm or predictive model that uses one, results in unfair discrimination with respect to race, and to remediate any discrimination detected.

Do not unfairly discriminate based on race, color, national or ethnic origin, religion, sex, sexual orientation, disability, gender identity, or gender expression, in any insurance practice.

Where the Commissioner of Insurance has adopted implementing rules for your type of insurance and practice, do not use an external consumer data and information source, or an algorithm or predictive model that uses one, in a way that unfairly discriminates on those same grounds.

Do not use artificial intelligence in a way that has the effect of subjecting an employee or applicant to discrimination on the basis of a protected class, and do not use a zip code as a proxy for a protected class, in recruitment, hiring, promotion, discipline, discharge, or the terms and conditions of employment.

A QCB-regulated entity deploying a High-Risk AI system must maintain an AI system register, adopt an AI governance policy, conduct risk and bias assessments, and provide human oversight of the system's decisions.

If you are a provider of a high-risk AI system, you may exceptionally process special categories of personal data to the extent strictly necessary to detect and correct bias under Article 10(2), points (f) and (g), provided all six conditions of Article 4a(1) are met: the bias cannot be effectively addressed with other data, including synthetic or anonymised data; the data is subject to technical re-use limits and state-of-the-art security, including pseudonymisation; the data is secured with strict access controls and documented access; the data is not transmitted, transferred, or otherwise accessed by other parties; the data is deleted once the bias is corrected or its own retention period ends, whichever comes first; and your records of processing activities under the GDPR, the EU institutions data protection regulation, or the law enforcement directive state why the processing was strictly necessary and why other data could not achieve the same result.

Do not let a decision made using an algorithmic system result in discrimination on a ground Kazakhstani law sets out.